Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I want to make a script that sees if a number of connection attempts are made from one or more IPs ($CT_MULTIPLE_IP_THRESHOLD) in an ammount of time ($CT_TIME). If this happens, than in that ammount of time ($CT_TIME), search through all IPs and ban those that exceed the maximum number of allowed trials for one IP ($CT_SINGLE_IP_THRESHOLD).

I have found the recent module which semms to be able to achieve this.

iptables -A INPUT -m recent --name port_multiple_scan --rcheck --hitcount $CT_SINGLE_IP_THRESHOLD --seconds $CT_TIME -j DROP

Q1: How can I do the threshold for multiple IPs (the hitcount can be used only with --rcheck or --update) ?

Q2: Can I do a ban IP (let's say in hosts.deny) instead of -j DROP?

Q3: Is there a betterm module (instead of recent)to use and how?

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.